Returning /me in a reasonable way, while preventing scams.

[abyss]

Alright...

Alright.

So a couple hours ago, this whole fiasco was one huge, huge storm of flame wars, debate and insulting. It got people nowhere, and all that happened was several threads were filled with over 300 pages of fighting. All of which was understandably locked.

So... I'm - personally, at least - going to apologise to the moderators and developers on this forum for my own, and really everybody's behaviour. I want all that crap to be put in the past, and I'd like it if we can focus on this issue from a sensible standpoint.

For those of you who missed the previous monsoon of anger, here's the basic gist:

The latest update to the steam client, in an effort to prevent people mimicking steam wallet system messages, removed the /me function from chat. An undocumented function that was originally included as "a fun little extra" that nevertheless exploded into huge usage by a large community of people. An "Ascended Extra" if you will.

Notably, it's removal sparked anger and aggression from both sides. One side wanted the function back, and the other was essentially telling the first side to "stop whining" and backing up Valve's decision 100%.

Both sides got into a huge fight, yadda, yadda, yadda, let's avoid that dirty business this time around, shall we?



First up, here's the initial problem: Scammers.

Due to its undocumented nature, the existence of the /me command was being exploited by scammers and used to mimic steam system messages, fake steam wallet details, and a number of other heinous things.

Naturally, this was all the developers saw of the issue, with support ticket after support ticket flooding in related to the problem, the normal response was "Well, if it's causing so many problems, get rid of it."

Unfortunately... Scammers weren't the only ones using the /me command. Whether you approve of it, participated or even were aware of its existence, there was a sizable community of people who used and enjoyed the /me command on an almost daily basis.

For myself, and many others, it added a whole new, wonderful element to the chat client: The ability to roleplay. Me and a close friend have been roleplaying over steam since 2010. And in that time frame, I've recorded down enough stories, character arcs, plots and the like to exceed the forum word limit at least ten times over.

Roleplaying - regardless of what many people think of it - was an important and often-used feature of steam's chat for myself, and for many others. It caused zero harm to anybody else outside a closed chat, it wasn't malicious and it helped me form one of the strongest friendships I've ever had. If not the strongest.
So, naturally, when the function was removed, rendering the medium through which we'd lived out whole new stories effectively ruined, many people were upset. Hell, "upset" is skimping over it, people were mad


Right now, as it stands, /me is still gone. There has been no compromise that I'm aware of, and thousands of steam users are missing a feature that they've enjoyed for a long, long time.


So how do we solve this problem? I know that there are those of you who are content for things to stay the way they are. And that's a fine opinion to have, but for us, we're not content. We want to sort out a reasonable compromise.

THIS IS NOT A THREAD FOR FIGHTING, NOR A THREAD FOR DEBATE OR ANY SORT OF CONFLICT.

THIS IS A THREAD FOR REASONABLE DISCUSSION, KEEP IT THAT WAY, PLEASE.

The ideal situation here for the long term is as follows: The /me command still exists, but scammers can no longer use it for malicious purposes.

Here's one of the ways in which this could be accomplished:

Step 1) Document the /me command as you would any other command:

This is essential as the unknown nature of the command was one of the primary contributions to it being exploited. Just as it is documented that you can edit your profile, change your display name and avatar image, document that /me is a thing you can do.

Step 2) Provide a detailed steam message warning in order to combat abuse:

Again, this one should have just been done from the start. We already have a message saying "don't tell your password to anybody!" So why not one that says "Remember to read the user guide to avoid being fooled!"? Not a big ask, I'd hope.

This would be helpful to people regardless of if they use /me or not. 90% of all scams are accomplished through a lack of knowledge on the victim's part. The best thing Valve can do is educate people on the subject.

Step 3) Make system and steam-wallet messages easier to discern from chat:

Users should never, ever be able to mimic system messages anyway. And that is not on them, it is on the developers. This entire fiasco could have easily been avoided in the first place had the steam system messages - notably the steam wallet figures - been more easy to discern against real chat.

This solution could be accomplished through something as simple as a change of text colour, or as complex as a whole new side-window exclusively for system messages. Either way, no user should be able to mimic them, in any fashion.

Step 4) Add /me as an optional extra, and have it off by default:

This idea was the subject of one of the more lengthy threads that recently got shut in the lockdown. But that doesn't excuse it from being a good idea. Here's the basic gist: When a user installs steam for the first time, the ability to use /me is turned off. However, with this suggestion in place, a simple on/off button would be added to the settings menu (off by default) saying "Allow Steam Emotes."

EG:

Chat with "Allow Steam Emotes" off (the default setting):
"[user]: /me does something."

Chat with "Allow Steam Emotes" on:
"[user] does something."

Step 5) Make /me commands visibly unique from all other kinds of text:

Another problem that existed with /me is that it was easy to confuse people as it made all your text blue or green as opposed to white. Even with documentation, this could understandably become an issue.

The solution would be to make /me commands look and feel far different to any other kind of chat. Here's one possible example:

Normal chat:
"[user]: Hey, how's it going?"

/me Emote chat:
"ᴇᴍᴏᴛᴇ | [user] bids you good day"

This is, of course, only one suggestion. Simply making /me emotes more obviously emotes would go a long way to preventing scams.

_____________________________________________________________________

OTHER IDEAS, FROM OTHER USERS:

Originally posted by ChrisW:

How about my idea of allowing the /me command on select roleplaying groups? That way everyone in those groups will already know about the command and you guys can pretend to be vampires or whatever you do. And the command will not be available for the rest of the people on Steam chat that have probably never even seen this command used.

Originally posted by Quick!SaveTheChildren:

If /me were made optional (if), Someone can come up with a tutorial or support page (not Valve, a /me supporter) that pops up in a window every time /me is enabled. Documentation is good, but I think if someone presented an actual document for Valve to look at they might consider it.

Originally posted by Gordon3465:

more chat formatting options and adding a drop-down menu to the chat titled "chat formatting" or something along those lines. the button is there to insert the chat commands, kinda like how it works in the forums.

on to my reasoning with this idea. it pretty much operates on curiosity, anybody new to the chat would naturally look at things and try figuring out how they work while long-term users would take a quick look at this new button as well..

this would allow us to add /me back in and put bold, italics, underlines, and whatever else into that drop-down menu. so, not only do we document /me and add it back in, we open up even more function for the chat.

Originally posted by Torment:

Suggestion:

Allow anyone to use /me again, but of course, render it differently. Make it display as *asterisk* emotes by default, plainly looking the same as if someone had typed out the emote manually, eg `Torment: *jumps on the bandwagon!*`.

Add a default-off advanced option that allows them to be shown IRC/classic style instead, eg `* Torment jumps on the bandwagon!`. Indicate the difference in display when the option is changed.

Originally posted by mendel

here's my entry: have the chat client track when a message starts with "/me", and make that clickable. When you do click it, the client stores the name of the sender and displays this message and all subsequent messages from the same sender in emote format. So if you roleplay, you need to click once on every message from every member of your group, and then you're done. Other people outside that group whom you may want to trade with will not be affected by that setting. Since it's locally stored, there's no server load; you may need to reactivate this if you reinstall Steam or switch to a different computer, but since the activation is just one click per person, that's not really much of a hassle.
You deactivate this on a per-sender basis by clicking on the emote message again. The sender's name could be the clickable link in this case, since that would suggest "if you want to find out more about the sender, click here", and that would uncover that it's just something the guy typed with /me in front.
(If Steam were open source, this would the point where someone could submit a patch to the client, since it doesn't even require anything on the part of the server guys.)

Modified proposal: the easy way to implement this is to not store the names of the senders persistently at all; that way, it's not even necessary to implement file operations. The roleplayers would need to do some clicking at the start of each roleplay session if they want it to look nice, but compared to actually roleplaying, it's still a small extra effort.

The advantage of this proposal is that the direct manipulation of the /me message communicates to the user that a normal message that this sender typed has now merely changed form and is displayed differently. The "modified form" mental model would keep users clued in: a user can't say "I thought this was a system message" when the user changed the format himself mere minutes before and can change it back with a simple click. Thus, the knowledge "this is a normal chat message that a normal user wrote" is kept present in the mind of the users. Other advantages: no kludgy warning messages, no settings hidden someplace that you need to find, no penalty to simply ignoring this feature altogether (you'll still understand the meaning of "Gustav: /me slaps you with a trout"), yet its activation process is very visible -- many people are going to try clicking on /me if it looks like a link and thus discover what it does, and it's also really obvious how to do this yourself.

Originally posted by Grady Vuckovic:[/b]

OK! How's this for an idea..

A simple set of rules for the application:
* When the application starts, /me is turned off and /me commands will not show formatted. This is true every time the application starts.
* Using a /me command turns /me commands back on. Receiving a /me command doesn't count.
* Beginning a trade turns /me commands off.
* /me commands cannot be turned back on while a trade is in progress.
* While /me commands are off, they show up unformatted with /me prefixing them.

Pros
* It's automatic, there's no checkbox to toggle, there's no need to store it as a setting. Easier than a saved configuration setting for the application.
* Unless the user actually uses '/me', then /me commands won't even be turned on, hence those who don't know about /me won't be tricked.
* The only way to turn it on, is to actually use the command, hence the only way to turn on the command is to personally use it and see it in action. Even if a person is told to type "/me text", they will see immediately what it does, thus educating them on what it does.
* The /me can't be used while in the middle of a trade, hence there's no danger of someone receiving a /me command in a trade and thinking the text comes from Steam.
* Accidentally turning on the command doesn't matter, once a trade is started it's turned off automatically and won't come back on till the user uses the command again.
* All the benefits mentioned before for having an optional /me command, like the fact that scammers won't know who they can and can't trick, thus making /me unusable for scammers.

Cons
* Can't trade while using /me. But.. who cares?

_____________________________________________________________________


Got a suggestion of your own? Add it in! I want this thread to be a forward thinking one.

Instead of fighting over this issue like a bunch of children arguing over a toy, let's find a viable solution that benefits everybody, please.

[Matt]

Messaggio originale di Quincy Quoll:

the exchange deal was Valve's idea and is suggested to developers by Valve

Got any sources on that? Not that I doubt it, but before I bring it up myself in future discussions I'd like to have something to fall back to if someone questions me.

Messaggio originale di Quincy Quoll:

You forgot the ghastly BIG PICTURE mode with a dangerous seppuku button (which launches it) that you can't disable.

I thought of it, but didn't put it on my list as it's a byproduct of Valve working on their Steam Box. Can't say I'm very fond of it myself though, but hey, at least it's optional.

[luckz]

http://forums.steampowered.com/forums/showthread.php?t=2042379 has some
a developer recently (last two months? last month?) posted the whole list of regions with Valve suggested prices for his game, but I was too stupid to screenshot it and can't find it again

[Matt]

Messaggio originale di Quincy Quoll:

http://forums.steampowered.com/forums/showthread.php?t=2042379 has some
a developer recently (last two months? last month?) posted the whole list of regions with Valve suggested prices for his game, but I was too stupid to screenshot it and can't find it again

Much appreciated. Time to step up my efforts to vote with my wallet again, I suppose.

[Master]

put it back please

[Go Fish]

Messaggio originale di Grady Vuckovic:

Considering that Valve does have some strong competitors, it's naturally in their best interest to appear more trustworthy than the rest. As it stands that's more or less exactly what puts them a thousand miles ahead of EA's Origin service, no one trusts EA. But if Valve's image was as bad as EA's, then Steam would have some serious competition from Origin.


.. At least that's what I would offer for a reason why Valve should care about this.

Origin is competitor of Valve? Don't make laugh my socks, it's personal EA's store while Valve's creation is mall that can be used by others, it's like saying that Apple's store is competitor to newegg. But in general I think you're right, every small feature or nuisanse affects way how willing customers would be. Actually that's why Blizzard had big success with their MMO when Manbearpig was Public Relation guy c.c

Suggestion: firstly, I ponder if it is enough to make /me working with friends only. Second if modify chat so names will be underlined links to user profiles in floating hint on mouseover, e.g. chat in html pseudocode would look like

<div title="User1: user1 profile here"><b><a href="userprofile1">user1</a></div>: Hello!
<i><div title="User2: user2 profile here"><b><a href="userprofile2">user2</a></div> waves </i>

<!-- div title in HTML produces textual tooltip. I actually suppose that it might be more complicated floater with profile picture or something - tools for that already are in code?>

[Esteri]

Hey, friends-only is a good idea. Not sure if it's been suggested before, but I like it. It helps eliminate at least a portion of the 'danger' of /me. Of course there are going to be arguments against that (some people will just add unknowns to their list) but I'd say it's still pretty solid overall. Maybe make it so you also need to remain on their friends list for a consecutive amount of time (say, two weeks) and have conversation windows opened at least three times...

[ThisCatStreams]

I just discovered /me was gone.

/me was like a little secret in steam that people shared in the community. At least that's how I discovered it through being in clans. Yeah it maybe nostalgia talking. But it feels wrong now that it is gone.

But lets get realistic. If anyone is giving up funds on steam or being scammed maybe they aren't mature enough to be using money online or mature enough to use a steam account anyway.

Really Valve you need to stick to your guns. I respect that you are trying to do right by everyone and keep us safe from hackers and what not. But when it comes down to common sense you need to say "We can do what we can. But if you are being fooled that's on you." Don't take responsibility for people's idiocy.

But really? It would take more than a user turning his text blue or green to get me to give up anything on my steam account.

But back to the talking about the legendary blue text.

I am not for the toggle option. Maybe I am old fashioned but I like it because it felt more like a secret to me, that I discovered through steam.

Steam is on the right lines. Scammers are less common. I remember when I got at least one phisher a day. I think I've only had one this year. That is steam and its security not taking away features.

Don't cater to the small vocal minority that have been using steam for a few years that will be gone in a few years.

Cater to your fans that have been using steam and plan to continue using it.

[Ganger]

Messaggio originale di d_cover:

But lets get realistic. If anyone is giving up funds on steam or being scammed maybe they aren't mature enough to be using money online or mature enough to use a steam account anyway.

Well said, someone had to say it.

[MA☝Omgwtfbbqstfu™]

Necroing a thread saying nothing new is hardly mature.

Doesn't matter how mature these people being scammed are, they cost valve significant support resources.

[Master]

Messaggio originale di MA☝Omgwtfbbqstfu™ #idle:

Necroing a thread saying nothing new is hardly mature.

Neither is acting as a moderator when you're not.

Messaggio originale di MA☝Omgwtfbbqstfu™ #idle:

Doesn't matter how mature these people being scammed are, they cost valve significant support resources.

Then again: would be much better a warning or any improvement in the chat are of the trade window rather than just deleting features: that's laziness and there is no excuse for it.

[Silicon Vampire]

OK. We are not starting up this merry go round again. If someone has something to say that has not already been said, contact me.

If it is not new to this discussion, don't bother. I will not respond.